CVE-2024-40761CWE-326

Apache Answer: Avatar URL leaked user email addresses

Medium · published September 25, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00749 · 54.4th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2024-09-25T07:31Z
EPSS history
Timeline
  • 25 SEP 07:31Z
    Apache Answer: Avatar URL leaked user email addresses
    cvelistv5